Low risk browser extensions

RetailMeNot: Codes, Cash Back and Coupons transmits full page DOM content from shopping and checkout pages to api.onsleek.ai via the Sleek SDK.

Destiny 2 Season Pass Wayback Machine ships a hardcoded Bungie Platform API key in its extension bundle.

SeoQuake SEO extension sends the domain and URL of every page visited to Semrush-owned API servers on all websites.

Video Downloader's content script has an unguarded message handler that sends the current URL and accepts DOM injection from any origin.

YouTube mp3 Downloader sends the current YouTube video URL to videomp3convert.com when the download button is clicked.

Ronin Wallet injects an Ethereum provider into all web pages and fetches an Amplitude script from cdn.amplitude.com with no integrity check.

Substital embeds the GiveFreely affiliate SDK and sends device and user IDs to GiveFreely when its popup opens on merchant sites.

Video Downloader - Video Hunter sends every TikTok URL you visit to third-party download services without requiring user action.

Forecastfox loads its API URL configuration from s3blog.org on startup with no integrity check, then routes all weather and location queries through those URLs.

Imageye - Image downloader lets users browse and download images from web pages.

Zoom Image opens a plain HTTP page on every extension update, exposing users to unencrypted content from the developer's server.

Streaming enhanced sends browsed content titles and locale to the TMDB API when the Show Rating feature is enabled.

Document Converter & Search overrides the browser default search engine to Yahoo using hardcoded affiliate tracking parameters.

Terms of Service; Didn't Read displays crowd-sourced ToS ratings for the current site by fetching a service database from api.tosdr.org.

7TV Nightly fetches a remote config to enumerate installed extensions and can disable flagged ones via the management API.

Video Converter World replaces the browser's default search engine with a Yahoo affiliate URL that embeds tracking parameters in every query.

XDM Browser Monitor v8+ intercepts cookies and request headers from all browser traffic and forwards them to a local download manager app.

ProxTube transmits a persistent UUID to its operator server on every proxy, config, and domain-list request, and reports which other extensions are installed.

Censor Tracker fetches its proxy server configuration from a remote GitHub URL and routes all browser traffic through that server.

FantasyPros injects a content script on all pages that can be triggered by any site to read and transmit a user's Sleeper auth token.

+Sub lets the current webpage request video details and frame thumbnails after the user clicks the extension.

AEM Sidekick lets external webpages request temporary cache-bypass header changes for chosen HTTPS hosts.

AI Mind Maps Maker sends selected text and page or PDF URLs to livepolls.app when users create mind maps.

AI Sidebar weakens frame protections and changes fetch headers for pages opened inside its side panel.

ARIA DevTools loads Google-hosted Fira Code web fonts into pages when you activate its overlay.

ASI Alliance Wallet exposes a page bridge that lets any website lock the wallet.

AYAYADASH - Anime Dashboard sends the user's IP address to ip-api.com to load weather for its new-tab page.

Admitad Extension sends visited HTTPS page URLs and search-result links to Admitad's offers API for affiliate matching.

BlockGuard lets any web page replace its stored sign-in token and then sends that token to BlockGuard cloud APIs.

Advanced Java Launch relays page-supplied download specs to a native application to download and execute Java resources.

Agent Master sends matched-site page-view events to qcitems.com with a persistent client ID.

Alephium Extension Wallet exposes its extension runtime ID to every website where its content script runs.

AliExpress Business reports AliExpress product page visits to s.want.shop with the page URL, price, and product image.

AliSaver sends AliExpress product details to AliTools and Deals99 for price history, recommendations, wishlist, and cashback.

Anime Live Wallpaper fetches popup HTML from api.gameograf.com and injects it into its new-tab page.

Appcues Builder accepts URL parameters from exposed extension pages and passes them into privileged builder actions.

AudioContext Fingerprint Defender can show fingerprint alerts based on messages from webpages.

AutoControl transmits a pseudonymous device ID, OS details, browser info, and usage statistics to its own server on install and update.

AutoTyper sends logged-in NitroType user IDs and tier values to autotyper.extreg.org from the garage page.

Gemini Automation sends a bundled client secret when it fetches remote configuration from its config servers.

Avatar Maker Studio exposes its extension ID in page DOM when quick access is enabled.

Bandcamp Tempo Adjust sends Bandcamp purchase dates to the Frankfurter exchange-rate API when you load purchases.

BearByLegacy lets any webpage open a transaction approval prompt without a prior dapp connection.

Best AI Art Generator (Free) - DiffusionDraw sends a FingerprintJS visitor ID with image-generation requests.

Best Proxy Switcher automatically disables other installed extensions that use proxy permissions.

Better ROBLOX Logo exposes its extension resource URL on Roblox pages while replacing the site icon.

BlankNewTab loads each new tab inside a remote iframe hosted on Amazon S3.

Booking.com price tracker sends Booking.com page URLs, titles, referrers, and a persistent user ID to Google Analytics.

Bookmark Manager loads its popup with a remote Bootstrap stylesheet from maxcdn.bootstrapcdn.com.

Bouncer - Filter your X feed sends X post text and media URLs to Imbue for filtering over a WebSocket.

BrandSearch stores its access and refresh tokens with an encryption key bundled in the extension.

The extension lets any hebbank.com page connect to an arbitrary native messaging host on the user's OS without validation.

CFCA CertEnrollment.UD Extension bridges CFCA web pages to native messaging hosts without validating the caller-supplied host name.

CFCA CryptoKit.SDRCB Extension bridges sdebank.com pages to local native messaging hosts without validating the host name supplied by the caller.

CSS Scan fetches stylesheet URLs through its background page and writes the responses into a page-readable iframe.

Cache Killer clears the browser cache before pages load when the user enables it.

CapMonster Cloud reads all cookies for the current site and attaches them to the captcha-solving request it sends to its own API.

Capios ships a disabled LinkedIn sharing branch with OAuth client secret and cookie values in web-accessible source.

Career.io Job Auto Apply lets any webpage set Career.io account tokens in the extension through an unchecked app.html message.

Cars Lightning Speed sends your leaderboard nickname and score over cleartext HTTP to a Disney highscores server.